elasticsearch學習筆記（二十四）——Elasticsearch query string語法以及_all元數據原理

一、query string 語法

GET /test_index/_search?q=test_field1:update
GET /test_index/_search?q=+test_field1:update

{
  "took" : 7,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 0.2876821,
    "hits" : [
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : 0.2876821,
        "_source" : {
          "test_field1" : "update test1",
          "test_field2" : "update test2"
        }
      }
    ]
  }
}

GET /test_index/_search?q=-test_field1:update
{
  "took" : 12,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 7,
      "relation" : "eq"
    },
    "max_score" : 0.0,
    "hits" : [
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "10",
        "_score" : 0.0,
        "_source" : {
          "test_field" : "test10 routing _id"
        }
      },
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "7",
        "_score" : 0.0,
        "_routing" : "2",
        "_source" : {
          "test_field1" : "test1"
        }
      },
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 0.0,
        "_source" : {
          "test_field" : "test client 1",
          "name" : "test1"
        }
      },
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 0.0,
        "_source" : {
          "test_field" : "test test",
          "name" : "test1"
        }
      },
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "7",
        "_score" : 0.0,
        "_routing" : "1",
        "_source" : {
          "test_field1" : "test1"
        }
      },
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "11",
        "_score" : 0.0,
        "_routing" : "12",
        "_source" : {
          "test_field" : "test routing not _id"
        }——
      },
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "20",
        "_score" : 0.0,
        "_source" : {
          "test_field" : "test consistency"
        }
      }
    ]
  }
}

對於query string只要掌握q=field:search content的語法，以及+和-的含義
+：表明包含這個篩選條件結果
-：表明不包含這個篩選條件的結果

二、_all metadata

也就是在使用query string的時候，若是不指定field，那麼默認就是_all。_all元數據是在創建索引的時候產生的，咱們插入一條document，它裏面包含了多個field,此時ES會自動將多個field的值所有用字符串的方式串聯起來，變成一個長的字符串。這個長的字符串就是_all field的值。同時創建索引。
舉個例子：
對於一個document：

{
    "name": "jack",
    "age": 26,
    "email": "jack@sina.com",
    "address": "guamazhou"
}

那麼"jack 26 jack@sina.com guamazhou",就會做爲這個document的_all fieldd的值，同時進行分詞後創建對應的倒排索引。
注意在生產環境中通常不會使用query string這種查詢方式。